PDA

View Full Version : DNS zone transfer


binaryrogue
1st May 2009, 09:10
I would like to allow zone transfer to a backup DNS server which is hosted by EditDNS. The IPSConfig box is currently now acting as the master and accepting DNS request from outside.

What else do I need to do besides adding the IP's "slave domain" where it says:
Allow zone transfers to these IPs (comma separated list) under the DNS tab for my zone?

For some reason it's not working. Are there any logs that I can look to see if the request being made from EditDNS? Do I need to modify any config files?

falko
2nd May 2009, 21:05
Can you post your /etc/mydns.conf file?

binaryrogue
4th May 2009, 06:16
## AUTOMATICALLY GENERATED BY DEBCONF. DO NOT MODIFY DATABASE
## INFORMATION (database, db-*)...
## PLEASE RUN 'dpkg-reconfigure mydns-mysql' INSTEAD.
## CHANGES TO THE FOLLOWING DIRECTIVES ARE NOT PRESERVED, BUT REPLACED,
## ON UPGRADE:
## user, group, pidfile, db-*, database

##
## /etc/mydns.conf
## Thu Aug 2 16:36:26 2007
## For more information, see mydns.conf(5).
##


# DATABASE INFORMATION

db-host = localhost # SQL server hostname
db-user = ispconfig # SQL server username
db-password = xxxx # SQL server password
database = dbispconfig # MyDNS database name


# GENERAL OPTIONS

user = nobody # Run with the permissions of this user
group = nogroup # Run with the permissions of this group
listen = * # Listen on these addresses ('*' for all)
no-listen = # Do not listen on these addresses


# CACHE OPTIONS

zone-cache-size = 2048 # Maximum number of elements stored in the zone cache
zone-cache-expire = 60 # Number of seconds after which cached zones expires
reply-cache-size = 2048 # Maximum number of elements stored in the reply cache
reply-cache-expire = 30 # Number of seconds after which cached replies expire


# ESOTERICA

log = LOG_DAEMON # Facility to use for program output (LOG_*/stdout/stderr)
pidfile = /var/run/mydns.pid # Path to PID file
timeout = 120 # Number of seconds after which queries time out
multicpu = 1 # Number of CPUs installed on your system
recursive = 68.87.78.130 # Location of recursive resolver
allow-axfr = yes # Should AXFR be enabled?
allow-tcp = yes # Should TCP be enabled?
allow-update = no # Should DNS UPDATE be enabled?
ignore-minimum = no # Ignore minimum TTL for zone?
soa-table = dns_soa # Name of table containing SOA records
rr-table = dns_rr # Name of table containing RR data
soa-where = server_id = 2 # Extra WHERE clause for SOA queries
rr-where = server_id = 2 # Extra WHERE clause for RR queries
use-soa-active = yes # To fix bug 295 where active or inactive status is ignored.
use-rr-active = yes# To fix bug 295 where active or inactive status is ignored.

falko
4th May 2009, 12:47
allow-axfr = yes # Should AXFR be enabled?That looks ok.
Please make sure that port 53 (TCP and UDP) is open in your firewall.

binaryrogue
4th May 2009, 19:42
Those DNS ports are defenitley open from the firewall. It must be EditDNS issue then. Thanks.

falko
5th May 2009, 20:16
In the MyDNS database, you can specify the slave server IP that will be allowed to connect to the master. You can try to add the IP of the slave there.

binaryrogue
5th May 2009, 22:26
I'm looking inside the dbispconfig database and can't figure where to input the slave IP's.
*update - I see where it's located now which is under the dns_soa table. I do see the same IP's that I put in from the web interface.

I just got a responds from EditDNS stating that my nameserver is refusing axfr (tcp 53) connections:
These ports are open, else my websites would not be accessible. I also ran a port scanner from outside and port 53/tcp and udp are open.

Question - Under the DNS zones, do I need to manually add EditDNS nameservers as well?

binaryrogue
6th May 2009, 02:56
I also tried to run this command from the server itself and it's failing.

[root@ispconfig3 ~]# dig @10.0.0.7 mydomain.com axfr

; <<>> DiG 9.5.1-P2-RedHat-9.5.1-2.P2.fc10 <<>> @10.0.0.7 mydomain.com axfr
; (1 server found)
;; global options: printcmd
; Transfer failed.

till
6th May 2009, 20:17
The slave IP's have to be entered directly into the field "Allow zone transfers to
these IPs (comma separated list)" in the ispconfig interface that is in the dns zone form. No need to edit anything in the database.

binaryrogue
6th May 2009, 20:28
Are there any logs for me to look at to see what's going on? It's just not working..

btw: I have two servers doing replication. The 2nd server acts only as my DNS.

wxman
7th May 2009, 22:28
I had a quick question about the /etc/mydns.conf file. Where it says:
multicpu = 1 # Number of CPUs installed on your system
recursive = 68.87.78.130 # Location of recursive resolver
if I have a dual core CPU should it say 2? Also is 'recursive' showing the name servers? I have dual core's and mine says '1', and there's nothing under the 'recursive' setting.

falko
8th May 2009, 16:33
I had a quick question about the /etc/mydns.conf file. Where it says:
multicpu = 1 # Number of CPUs installed on your system
recursive = 68.87.78.130 # Location of recursive resolver
if I have a dual core CPU should it say 2?If you want MyDNS to use both CPUs, then yes.

Also is 'recursive' showing the name servers? I have dual core's and mine says '1', and there's nothing under the 'recursive' setting.If you want your MyDNS to resolve domains/hostnames for which it is not authoritative, then you need to put another nameserver under recursive (e.g. a nameserver of your ISP).

wxman
8th May 2009, 17:20
Thanks. Glad to know.

binaryrogue
10th May 2009, 08:59
Is there a test I can run on the machine itself to see if it's working?

falko
11th May 2009, 14:04
Take a look at the logs on the slave (if you're on Debian/Ubuntu, it's /var/log/syslog). This will tell you if zone transfers are successful or not.

binaryrogue
12th May 2009, 23:28
I'm in the process of asking them (EditDNS) for logs.

They are just telling me that it's refusing axfr (tcp 53) connections:
[root@ns2 ~]# dig @1.1.1.1 mydomain.com axfr

; <<>> DiG 9.3.4-P1 <<>> dig @1.1.1.1 mydomain.com axfr
; (1 server found)
;; global options: printcmd
; Transfer failed.

--

If I telnet to the ispconfig box from outside on port 53, it connects fine.

[root@romain ~]# telnet mydomain.com 53
Trying 1.1.1.1...
Connected to mydomain.com (1.1.1.1).
Escape character is '^]'.

binaryrogue
12th May 2009, 23:43
Isn't this command suppose to verify that my dns server accepts axfr transfers? I added the IP of itself (10.0.0.7) to the Allow zone transfers to
these IPs (comma separated list) as well.


[root@ispconfig3 ~]# dig @10.0.0.7 mydomain.com axfr

; <<>> DiG 9.5.1-P2-RedHat-9.5.1-2.P2.fc10 <<>> @10.0.0.7 mydomain.com axfr
; (1 server found)
;; global options: printcmd
; Transfer failed.

tio289
13th May 2009, 17:19
try to add only your public IP and run

dig axfr zone.sk @1.2.3.4

binaryrogue
13th May 2009, 20:46
I added my public IP and same result.


[root@ispc2 ~]# dig axfr zone.sk @1.2.3.4

; <<>> DiG 9.5.1-P2-RedHat-9.5.1-2.P2.fc10 <<>> axfr zone.sk @1.2.3.4
;; global options: printcmd
;; connection timed out; no servers could be reached

tio289
13th May 2009, 20:49
yeah:-D

you change zone.sk to your zone name and 1.2.3.4 change to you server IP it is example only

if you have GTalk I can help you. (my Gtalk is feldsam@gmail.com)

binaryrogue
14th May 2009, 02:49
seems to be a bug in mydns:

http://www.howtoforge.com/forums/showthread.php?t=32145&page=2

from falcontx:
The problem is that the query is looking for "active=1" in the dns_soa table. However, in ISPConfig 3.0.1.1 (and probably the SVN, as well), the "active" field in the dns_soa table is type "enum('N', 'Y')", so that query will always fail.

this thread solved the issue.